New on LowEndTalk? Please Register and read our Community Rules.
All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.
All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.
Is having separate PHP-FPM Pools a security feature?
Hi,
I am using Webinoly stack to manage my WP sites from a year. It's been a wonderful experience with zero issues. https://github.com/QROkes/webinoly
Only complaint I have with this stack is that they do not create separate PHP-FPM pools for each site. Author is not convinced of this as a security feature. https://github.com/QROkes/webinoly/issues/10
I am myself only managing the sites, ssh, sftp, plugins installations and no other user can. Most of the sites uses similar set of WP plugins. I think PHP fpm pools+separate users will give more isolation in case a site is hacked due to a plugin vulnerability. What are your thoughts?
Comments
No. Just better resource management. Suexec on the other hand...
It brings some level of isolation. Not perfect but better than nothing. Of course if one exploit leads to privilege escalation you're fucked. But it wouldn't have been better with the "single user" setup. I see no reason not to deploy php-fpm with one user per site (or small groupe of sites).
You need to secure other way, like disable certain functions to be execute by PHP, example: exec, shell_exec, more information about it:
https://www.cyberciti.biz/faq/linux-unix-apache-lighttpd-phpini-disable-functions/
Exactly. The good point with having separate pools with different users is that is a site needs a special function, you can enable it only for this site, and keep a stricter rule for the other ones.
It does sound to me that it would be better isolation but maybe also it would use more memory if I am not mistaken.
I would recommend seperate php-fpm pools with seperate users.
In case if a single site is compromised he will have access to only php file read and write access granted to those users.
This is why I wrote this
https://github.com/noamanahmed/LEMP
Jailed Users with seperate php-fpm pools.
Thanks for your reply guys. I found an old article suggesting selective elevation when updating wordpress, plugins or theme. I find it very interesting. Not sure if there any major cons with this method. http://kbeezie.com/elevate-php-nginx-wordpress/
Ignore the above method as it's not properly isolated and wp-admin can be used to run a script. I'll use an unique pool per site. Thank you all for the help!